InfoSecBulletin Cybersecurity for mankind
Qualcomm has unveiled its May 2026 Security Bulletin, revealing serious flaws with its software and hardware. The bulletin points out several Critical issues that could let unauthorized users access and damage memory on millions of devices using Qualcomm chipsets.
The company is sharing updates with Original Equipment Manufacturers (OEMs) and has advised them to install these updates on released devices as soon as they can.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The biggest flaw fixed this month is CVE-2026-25254, which has a CVSS score of 9.8. Discovered in the Qualcomm Software Center, this “Critical” flaw relates to wrong permissions in the SocketIO interface.
Vulnerability Type: Improper Authorization (CWE-285).
Impact: This flaw leads directly to Remote Code Execution (RCE).
Access Vector: Remote.
Affected Versions: QSC v1.17.1, v1.19.1, and v1.21.0.
An attacker could use this interface to run harmful commands without being near the device.
Another critical flaw resides at the very foundation of device security: the Primary Bootloader. Tracked as CVE-2026-25262, this “Write-what-where” condition occurs while the system processes a crafted ELF (Executable and Linkable Format) file.
While this attack needs local access, it causes serious memory damage that threatens boot integrity. This problem impacts various old and special chipsets, like the MSM8909, MSM8916, and SDX50.
Qualcomm also fixed a serious problem in its PLC (Power Line Communication) Firmware, known as CVE-2026-25293. This issue has a CVSS score of 9.6 and is due to wrong authorization that causes a buffer overflow. Like the Software Center issue, this flaw can be accessed from afar and affects the QCA7005 chipset. The risk is greater because the exploit can bypass security and affect the whole system.
Qualcomm makes the technology for many smartphone and IoT makers, so users can’t fix these problems themselves. You have to wait for your device maker (OEM) to give a system update.
